<?php header('Content-Type: application/json'); $allowed = ['127.0.0.1', '::1', '10.69.69.1', '10.69.69.7']; $clientIp = $_SERVER['REMOTE_ADDR'] ?? ''; if (!in_array($clientIp, $allowed)) { http_response_code(403); exit(json_encode(['error' => 'Unauthorized'])); } $hmacKey = ''; $hmacPath = '/var/www/private/bridge_hmac.key'; if (file_exists($hmacPath)) { $hmacKey = trim(file_get_contents($hmacPath)); } $signature = $_SERVER['HTTP_X_HMAC_SIGNATURE'] ?? ''; $body = file_get_contents('php://input'); if ($hmacKey && $signature) { $expected = hash_hmac('sha256', $body, $hmacKey); if (!hash_equals($expected, $signature)) { http_response_code(403); exit(json_encode(['error' => 'Invalid signature'])); } } $data = json_decode($body, true); if (!$data) { http_response_code(400); exit(json_encode(['error' => 'Invalid JSON'])); } define('DASHBOARD_ROOT', '/var/www/dashboard'); define('PRIVATE_DIR', '/var/www/private'); require_once '/var/www/dashboard/core/config.php'; require_once '/var/www/shared/db.php'; require_once '/var/www/shared/encryption.php'; $gmail_uid = $data['gmail_uid'] ?? null; $sender = $data['sender_email'] ?? ''; $senderName = $data['sender_name'] ?? ''; $subject = $data['subject'] ?? ''; $amount = (float)($data['amount'] ?? 0); $reference = $data['reference_number'] ?? ''; $rawBody = $data['raw_body'] ?? ''; $receivedAt = $data['received_at'] ?? date('Y-m-d H:i:s'); if ($gmail_uid) { $exists = Database::scalar("SELECT COUNT(*) FROM etransfer_inbox WHERE gmail_uid = :uid", [':uid' => $gmail_uid]); if ($exists > 0) { exit(json_encode(['ok' => true, 'status' => 'duplicate'])); } } $senderEnc = Crypt::encrypt($sender, 'payment'); $senderNameEnc = Crypt::encrypt($senderName, 'payment'); $subjectEnc = Crypt::encrypt($subject, 'payment'); $rawBodyEnc = Crypt::encrypt($rawBody, 'payment'); Database::execute( "INSERT INTO etransfer_inbox (gmail_uid, sender_email, sender_name, subject, amount, reference_number, deposit_status, raw_body, received_at)      VALUES (:uid, :email, :name, :subj, :amt, :ref, 'auto_deposited', :body, :rcv)", [ ':uid' => $gmail_uid, ':email' => $senderEnc, ':name' => $senderNameEnc, ':subj' => $subjectEnc, ':amt' => $amount, ':ref' => $reference, ':body' => $rawBodyEnc, ':rcv' => $receivedAt, ] ); $insertId = Database::scalar("SELECT LAST_INSERT_ID()"); $matchedOrder = Database::fetchOne( "SELECT id, reference FROM orders WHERE status IN ('pending','hold') AND ABS(total - :amt) < 0.02 AND (reference = :ref OR :ref2 LIKE CONCAT('%', reference, '%') OR :body LIKE CONCAT('%', reference, '%')) ORDER BY created_at ASC LIMIT 1", [':amt' => $amount, ':ref' => $reference, ':ref2' => $reference, ':body' => $rawBody] ); if ($matchedOrder) { Database::execute( "UPDATE etransfer_inbox SET verification_status = 'verified', matched_order_id = :oid, verified_at = NOW() WHERE id = :id", [':oid' => $matchedOrder['id'], ':id' => $insertId] ); Database::execute( "UPDATE orders SET status = 'paid', status_code = 2002, status_label = 'Paid',                 fulfillment_stage = 'picking', stage_updated_at = NOW(),                 etransfer_ref = :ref          WHERE id = :id", [':ref' => $reference, ':id' => $matchedOrder['id']] ); Database::execute( "INSERT INTO payment_ledger (order_id, payment_method, amount, currency, direction, reference)          VALUES (:oid, 'etransfer', :amt, 'CAD', 'credit', :ref)", [':oid' => $matchedOrder['id'], ':amt' => $amount, ':ref' => $reference] ); exit(json_encode(['ok' => true, 'status' => 'auto_matched', 'order_id' => $matchedOrder['id']])); } exit(json_encode(['ok' => true, 'status' => 'pending_match', 'etransfer_id' => $insertId]));
 